Slashdot Mirror
Microsoft Hops On Two-Factor Authentication Bandwagon
itwbennett writes "Following similar initiatives by Apple, Google and Facebook, Microsoft is enabling two-factor authentication for its Microsoft Account service, the log-on service for many of its online and desktop products. Users will find instructions on how to add a second form of authentication on the Microsoft Account settings page. The chief form of secondary authentication will be a short code sent to the user's mobile phone, the number of which Microsoft will keep on file, each time the user logs on."
Will I not be able to pirate Win8.1?
I'm not sure Microsoft actually understands two factor authentication. The description (could be wrong, didn't read the article) doesn't sound like two factor authentication to me.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
This isn't really two-factor auth. If someone steal your phone, you are screwed.
Unless you're a Microsoft developer, what would anyone want a "Microsoft account" for? Hotmail?
when i can have Bills, Balmers, Larry, Sergei and the rest of the executives
maybe someone should start a website with this information, if you have nothing to hide..........
I'm not sure that I want to give Microsoft my phone number. I switched to outlook.com from Google because of privacy concerns (If you know a better free solution then feel free to share the info btw) and it's not to give away an information like a real phone number.
The new option Microsoft authentication approach, as they describe it, is "two-step authentication", not "two-factor authentication". And, while the correct choice among the options they provide might make it two-factor authentication, they don't seem to focus on that in any particular way.
Two-factor authentication is "something you have and something you know" (commonly, the something you know is a password, the something you have is a device generating comfirmation codes.) The options for the second step in authentication (password is the required first step for Microsoft accounts) include a code sent to an email address on file, making it "something you know" (your Microsoft account password" plus "something else you know" (the password to alternative email.)
(Plus, since its sent through regular plaintext email if you are using that option, the second "step", in that case, relies on you supplying back information that Microsoft sends you over a completely insecure channel.)
I understand the *convenience* offered by the alternative to actual two-factor authentication here, but I don't understand why this is done since the convenience in "two-step" authentication that allows you to choose for it not to be two-factor authentication defeats the entire purpose of not using simple one-factor authentication.
"The chief form of secondary authentication will be a short code sent to the user's mobile phone"
Some people don't have $400 per person per year for their own mobile phone. Instead, they share a house phone. Since when can land lines receive text messages?
If MS really cared that much about security they would offer the use of client certificates. Much more secure than SMS.
Judging by what passes for acceptable practice today my guess this is all likely all effectivly a moot point as convenience password recovery measures effectivly curtail actual security gains.
http://www.rollcall.com/news/senate_torpedoes_background_check_deal-224103-1.html?zkPrintable=true
"Senate Torpedoes Background Check Deal"
Oh yea, make that Democratic Senate.
Just want to gloat at you douchebags. Gloat! Gloat! Gloat! Gloat!
Microsoft Accounts have supported two factor authentication for "sensitive" actions for quite a while -- adding trusted PCs, changing billing methods, resetting passwords, etc ...
Two things new with this:
- The ability to set the account to require it at login for normal authentications
- The ability to use 3rd party token applications (like Google Authenticator) for the tokens, instead of SMS.
Two-Factor has been free for ages. You can get an NPS module that does text message, google auth, and loads of stuff at www.wrightccs.com and have been able for a long time.
I desperately want Microsoft to have my phone number. They would never sell that.
Is this some sort of scam to get marketing data because Bing sucks?
Microsoft is constantly hopping on bandwagons. It gets them free advertising. They don't care that a good chunk of the population points out that they do things poorly, mislabel things, intentionally name things wrong, break standards, break other products, etc... They care that you are talking about them.
Every other week we read about MS hyping some other bullshit they think they invented. Most laugh at them, a few fanbois run out and buy what ever they are hawking, but most importantly we all see their name enough where it's impossible to ignore it.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
All of these authentication measures seem to want my cell phone.
I don't have onr, and you can phone me when Hades freezes over.
-- Tigger warning: This post may contain tiggers! --
2 -- something new,
3 -- something borrowed,
4 -- something blue,
Wait, isn't that what we were talking about?
True, the 8- and 16-bit titles in the Mega Man and Metroid series are probably better played with a gamepad than with a pointing device. But pointing device advocates would claim that the play style of these older games is a relic of the past, and series need to evolve to keep up with changing play styles implied by higher-resolution input devices. For example, a pointing device would have helped third-person shooters like Mega Man Legends and first-person shooters like Metroid Prime series. In fact, Nintendo made Metroid Prime 3 for its Wii Remote pointing device and remade several games for the Wii Remote for its "New Play Control" line, including a 3-pack of the Metroid Prime series. You can help keep your argument relevant by explaining how controller-friendly play styles aren't a relic.
I don't think very many genres benefit from having controller support
In light of someone's recent post about what he perceives to be the reality of the video game market, I've been doing a bit of research into what makes a game better with a controller than with a pointing device. Any game where the player controls one character on the screen that moves and jumps would benefit from a gamepad. Platformers and fighting games are the big ones, and I'm not sure how well the Zelda games for DS worked with pointing-device-only control.
if the game supports a controller on the xbox/ps3 then it probably does on the PC as well.
Mortal Kombat (2011) doesn't support a controller on the PC because it isn't made for PC. If a game is on Xbox 360 but the publisher has declined to port it to the PC, you need a Microsoft account and an Xbox Live Gold subscription to play online.
If you don't have a cell phone, you can't use this
As of right now, "this" means the 2-factor authentication for a Microsoft account. Perhaps my paranoia comes from a fear that Microsoft might make 2-factor authentication mandatory.
pre-paid SIM
Each U.S. carrier that I've looked at will expire the balance on a prepaid mobile phone account if the user doesn't top up regularly. And in the United States, the receiver pays 20 cents to receive a text message unless the receiver is on a monthly unlimited texting plan. Having to pay the carrier a dollar every five times I log in to anything that uses a Microsoft account could add up quickly.
Anyone who considers 2-D games "relic"
It's not that games with 2D graphics are "relics". It's that gamepads are allegedly "relics". The most popular mobile gaming platforms today are iOS and Android, and those ship with a capacitive multitouch screen. A lot of popular touch-oriented games, such as Angry Birds series, use 2D graphics. So do plenty of mouse-driven Flash games on Newgrounds. Other than 2D platformers and fighting games, whose popularity compared to other genres has waned, what genres really need a gamepad?
isn't worth arguing with.
Yet pointing device advocates keep arguing for pointing devices, and they occasionally get moderated up. So it's best to have a counterargument ready instead of just an ad hominem.
It's a trade-off between either the extra security of two-factor authentication, or the convenience of linking more than one account to be able to switch between them with ease. Why can't Microsoft follow Google's lead and give us the ability to both log in securely and stay logged in to multiple accounts at the same time? It's irritating enough to have to log out and then log back in with the other username/password, and the "stay logged in" check box is fucking useless when you have to log out every god damn day anyway to check something on your other account.